Throw MemoryError in GMP string rendering and gmp_export()

Author: ramsey

ext/gmp/gmp.c

@@ -672,6 +672,11 @@ static void gmp_strval(zval *result, mpz_t gmpnum, int base) /* {{{ */
 		num_len++;
 	}
 
+	if (UNEXPECTED(zend_string_alloc_size_exceeds_memory(num_len, 1, 0))) {
+		ZVAL_EMPTY_STRING(result);
+		return;
+	}
+
 	str = zend_string_alloc(num_len, 0);
 	mpz_get_str(ZSTR_VAL(str), base, gmpnum);
 
@@ -841,6 +846,10 @@ ZEND_FUNCTION(gmp_export)
 		size_t bits_per_word = (size_t) size * 8;
 		size_t count = (size_in_base_2 + bits_per_word - 1) / bits_per_word;
 
+		if (UNEXPECTED(zend_string_alloc_size_exceeds_memory(count, size, 0))) {
+			RETURN_THROWS();
+		}
+
 		zend_string *out_string = zend_string_safe_alloc(count, size, 0, 0);
 		mpz_export(ZSTR_VAL(out_string), NULL, order, size, endian, 0, gmpnumber);
 		ZSTR_VAL(out_string)[ZSTR_LEN(out_string)] = '\0';

ext/gmp/tests/gmp_memory_error.phpt

@@ -0,0 +1,38 @@
+--TEST--
+GMP string rendering throws a catchable MemoryError when the result cannot fit in the memory limit
+--EXTENSIONS--
+gmp
+--INI--
+memory_limit=64M
+opcache.enable_cli=0
+--FILE--
+<?php
+
+$huge = gmp_pow(2, 2000000000);
+
+try {
+    gmp_strval($huge);
+} catch (MemoryError $e) {
+    echo 'gmp_strval: ' . $e::class . ': ' . $e->getMessage() . "\n";
+}
+
+try {
+    (string) $huge;
+} catch (MemoryError $e) {
+    echo 'cast: ' . $e::class . ': ' . $e->getMessage() . "\n";
+}
+
+try {
+    gmp_export($huge);
+} catch (MemoryError $e) {
+    echo 'gmp_export: ' . $e::class . ': ' . $e->getMessage() . "\n";
+}
+
+var_dump(gmp_strval(gmp_init(255)));
+
+?>
+--EXPECT--
+gmp_strval: MemoryError: The resulting string is too large to fit in the configured memory limit
+cast: MemoryError: The resulting string is too large to fit in the configured memory limit
+gmp_export: MemoryError: The resulting string is too large to fit in the configured memory limit
+string(3) "255"